> For the complete documentation index, see [llms.txt](https://support.agentfire.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.agentfire.com/spark-editor/lead-forms/anti-spam-feature-in-our-lead-forms-a-honeypot-field.md).
# How to Stop Spam Leads From Your Website Forms
Stop spam leads from your website forms with reCAPTCHA, the hidden honeypot field, blacklists and AI Anti-Spam, and find out where spam is really coming from.
Your website has four layers of spam protection. Most spam stops when all four are on. No setting blocks 100% of spam, but together they catch nearly all of it.
| Protection | What it does | Where it's set |
| ---------------- | ----------------------------------------------------------------- | --------------------- |
| **reCAPTCHA** | Google checks that the visitor is a person | Each form |
| **Honeypot** | A hidden field only bots fill in. Those leads are marked as spam. | Each form |
| **Blacklist** | Blocks leads from emails, words or countries you choose | Notification Settings |
| **AI Anti-Spam** | Akismet filters spam automatically | Notification Settings |
## Turn on reCAPTCHA and the honeypot on a form
Do this for each form on your site: your Contact page, homepage and any landing pages.
{% stepper %}
{% step %}
### Open the form's settings
Edit the page, click the form, then click the pencil on its **Lead Form** label. On the **Content** tab, open **Form Settings**.
{% endstep %}
{% step %}
### Turn on both protections
Scroll to **Anti-Spam** and turn on **Lead Form Recaptcha** and **Lead Form Honeypot**.
Leave **Honeypot Field Name** as **city**, unless your form already has a real field called "city". In that case, change it to another normal-sounding word like "referral". Don't use "honeypot".
{% endstep %}
{% step %}
### Save
Click **Save** in the top right.
{% endstep %}
{% endstepper %}
{% hint style="info" %}
On **custom** forms, the honeypot is a field: add **Honeypot** from the list of fields instead of using the toggle. The **Find Your Neighborhood** form has its own **Anti-Spam** section on its **Content** tab.
{% endhint %}
## Turn on the blacklist and AI Anti-Spam
{% stepper %}
{% step %}
### Open Anti-Spam Options
Open the menu in the top left and go to **Lead Manager** > **Notification Settings**, then click **Anti-Spam Options**.
{% endstep %}
{% step %}
### Add what to block
Turn on **Enable Blacklist**, then add:
* **Email:** addresses that keep sending spam.
* **Keyword:** words that show up in spam messages, like a link or company name.
* **Countries:** countries you don't do business with. Leads from there are blocked, but people there can still visit your site.
{% endstep %}
{% step %}
### Turn on AI Anti-Spam and save
Make sure **Enable AI Anti-Spam** is on, then click **Save Settings**.
{% endstep %}
{% endstepper %}
## What happens to spam leads
Leads caught by the honeypot still show up in **Lead Manager**, marked as spam and hidden by default. They aren't sent to your CRM.
## Still getting spam? Find out where it's coming from
Spam in your CRM doesn't always come from your AgentFire forms.
1. **Check Lead Manager**, including leads marked as spam (they're hidden from the normal list). If the lead isn't there at all and nobody deleted it, it probably didn't come from an AgentFire form.
2. **Check the lead's source in your CRM.** In Follow Up Boss, open the contact and look at **Source**.
3. **Follow Up Boss Pixel Form Capture.** If Pixel Form Capture is on in Follow Up Boss, it copies every form on your site, spam included. If your site is connected to Follow Up Boss with an API key, real leads already arrive that way, so you can turn Form Capture off. You don't need to remove the pixel.
4. **Property inquiry and tour forms from an IDX other than AgentFire IDX** are run by that IDX company. Their anti-spam settings are on their side.
## Common Questions
I turned everything on and still get some spam.
A few can still get through, especially from people typing in spam by hand. Add their email and repeated words to the blacklist. If you're still getting a lot, email with your site address and a couple of the spam lead names.
Spam is in Follow Up Boss but not in Lead Manager.
It probably isn't coming from your AgentFire forms, but check Lead Manager's spam leads first, since they're hidden from the normal list. Then check the contact's **Source** in Follow Up Boss, and whether Pixel Form Capture is on.
Can I block bots from visiting my site?
These settings stop spam leads, not visits. Bot visits may still show in your analytics.
I can't find the honeypot setting.
It's in the form's **Form Settings** under **Anti-Spam**. On custom forms, add the **Honeypot** field instead. If you don't see either, email with the page address.
Can you set this up for me?
Yes. Email and we'll turn on protection on all your forms and update your blacklist.